Website
SSL Checker
Inspect certificate validity, issuer and expiry.
Results appear here. Enter a hostname or https:// URL, then select Check certificate.
Domain Health Report
This page checks one thing. The report checks thirteen — and tells you what to fix first.
A one-off €14.90 report, delivered by email in minutes. Every finding comes with a concrete fix, prioritized.
- DNS records (A/AAAA)
- Nameservers (NS)
- Mail servers (MX)
- SPF record and policy
- DMARC record and policy
- DKIM record (common selectors)
- HTTPS availability
- HTTP to HTTPS redirect
- TLS certificate (issuer, validity, expiry)
- Security headers (HSTS, CSP…)
- CAA records
- robots.txt availability
- sitemap.xml availability
How the SSL check works
- Enter a bare hostname such as example.com, or a full https:// URL, and submit the form.
- The FKINFAST server opens a direct TLS connection to the destination on port 443, performs a full certificate verification and reads the leaf certificate.
- The result shows the subject, issuer, validity window, days remaining, alternative names and negotiated protocol, with a PASS, WARNING, FAIL or UNKNOWN classification.
The check runs from FKINFAST's server, not from your browser. The hostname is not stored, and no page content, response header or resolved IP address is returned to this page.
Result states
- PASS
- The certificate is valid, trusted and matches the hostname.
- WARNING
- The certificate is valid but expires within 14 days and should be renewed.
- FAIL
- The certificate is expired, not valid for the hostname, self-signed, revoked or otherwise not trusted — or the TLS handshake could not be completed.
- UNKNOWN
- No certificate verdict was read: the check timed out, the connection failed, or the destination was rejected.
Page-level errors are separate from these results. A validation error, rate limit, busy response, unavailable service or network failure is shown as an error, not as a FAIL result.
Hostname rules and limits
- Enter a bare hostname (example.com) or a full https:// URL.
- Connections are made to port 443 only. Other ports cannot be probed.
- Loopback, private, link-local, multicast and cloud metadata destinations are blocked before any connection is made.
- Plain http:// URLs are rejected — certificate checks are TLS-only.
- The handshake uses the same strict verification as a browser: validity dates, hostname match and the full trust chain are enforced.
- One hostname is checked per request, limited to 5 checks per 60 seconds per client IP.
What the checker does not return
The checker inspects certificate metadata only. It never returns page content, response headers, the resolved IP address or any private key material. Query strings are omitted from the URLs shown in results.
SSL checker FAQ
Is the hostname kept private?
No. The hostname is sent to the FKINFAST server so the TLS handshake can run there. FKINFAST does not store the hostname or the result. Standard edge and server request metadata, such as time and source IP, may be retained by Cloudflare and the hosting provider as part of normal operation.
Why did a valid certificate get a WARNING?
A WARNING means the certificate is otherwise valid but expires in 14 days or less. Renew it now to avoid an outage — renewals can take a while to propagate.
Why does a self-signed certificate fail?
Self-signed certificates are not backed by a trusted certificate authority, so browsers show a security warning. The FAIL result matches what your visitors would see.
Can I check a plain http:// site?
No. Only TLS (https) connections are checked, and an http:// input is rejected. Use the HTTP Status Checker for plain HTTP diagnostics.
Is this continuous certificate monitoring?
No. It performs a single check from one server at one point in time. It is not continuous monitoring and cannot alert you when a certificate expires — set up a reminder before the renewal date.